NSA Warnings: Current Cybersecurity and National Security Threat Advisories
This page tracks current warnings from the National Security Agency (NSA), including joint advisories NSA issues with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and allied agencies. Each entry links to the official page we opened and says who issued it. Where NSA did not issue a warning on a major event, we say which agency did.
Last updated: October 27, 2026
Current NSA and joint warnings
PHP2Shell: critical PHP flaws (CVE-2026-109618, CVE-2026-109619)
Issued by: NSA; CISA (separate alert)
NSA said the flaws, nicknamed “PHP2Shell,” “could allow attackers to take control of affected web servers without prior access or authentication” and that cyber actors “are likely to weaponize” them. CISA said it had not observed exploitation as of publication and urged an immediate update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Recommended actions: Inventory every system that relies on PHP, patch internet-facing systems first, add logging, replace end-of-life PHP, and take systems offline if they cannot be patched (NSA, CISA).
Official source: NSA advisory ↗CISA alert ↗
#StopRansomware: SafePay ransomware
Issued by: CISA, FBI, U.S. Secret Service and international partners (NSA not listed)
CISA said SafePay is one of the most active ransomware groups of 2026, with about 600 victims in the Americas, Europe and Australia. According to CISA, the actors break in with stolen credentials and known flaws in internet-facing devices, delete backups, steal data and encrypt systems.
Recommended actions: Patch known exploited vulnerabilities in internet-facing systems, require multifactor authentication, keep tested offline backups and segment networks (CISA).
Official source: CISA news release ↗Advisory AA26-293A ↗
ConnectWise supply-chain compromise (Storm-0940)
Issued by: Microsoft Threat Intelligence (no NSA, CISA or FBI advisory found as of Oct 22)
Microsoft said it “assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise” and described Storm-0940 as a China-state aligned actor that used an agentic AI penetration-testing framework called ARTEX.
Recommended actions: Microsoft told customers to review service principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise's containment guidance while preserving evidence.
Official source: Microsoft Security blog ↗
CISA adds PHP2Shell flaws to its Known Exploited Vulnerabilities catalog
Issued by: CISA (NSA's own PHP2Shell advisory is listed above)
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 26, 2026, and revised its PHP alert to reflect the change. CISA says a vulnerability must have evidence of exploitation to be added to the catalog. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize fixing high-risk KEV vulnerabilities on publicly exposed systems, according to CISA.
Recommended actions: Use the SIGMA detection rule CISA added to its alert on Oct. 23 to look for suspicious activity in logs, and treat a web application firewall only as a stopgap until systems are updated (CISA).
Official source: CISA KEV alert ↗
Cybersecurity event disrupts UNM Health hospitals and clinics in New Mexico
Issued by: University of New Mexico Health Sciences Center (no NSA, CISA or FBI advisory found as of Oct. 27)
UNM Health said a cybersecurity event on Oct. 26, 2026 affected the entire UNM Health Sciences Center. It said it diverted ambulance traffic to other hospitals, limited its acceptance of new patients from 12:30 to 2:30 p.m. Mountain time and suspended outpatient surgeries and appointments for the rest of the day. UNM Health said it notified state and federal law enforcement and began bringing systems back online in phases at 2:30 p.m. In its 10:27 p.m. update, it said both of its hospitals were open and that clinics would resume scheduled appointments on Oct. 27.
Recommended actions: UNM Health said it will work with patients to reschedule missed appointments and procedures. It asked nonessential Health Sciences Center employees to stay home on Oct. 27 and said it is limited in what it can share because the matter is an active law enforcement investigation (UNM HSC).
Official source: UNM HSC update ↗
GMO Internet confirms cyberattack and extortion threat on Onamae.com Desktop Cloud
Issued by: GMO Internet, Inc. (company notices; no NSA, CISA or FBI advisory found as of Oct. 27)
GMO Internet said its investigation confirmed that the service “had security vulnerabilities,” that its environment was accessed without authorization and that customer information was taken. The company said some customers reported trading-account transactions they did not recognize, that a person believed to be the attacker demanded money, and that it will not pay. GMO also said it asked the Japanese government to use active cyber defense measures. In its seventh report on Oct. 26, GMO said people believed to be the attackers told it they would publish customer information and carry out a ransomware attack at noon on Oct. 27, Japan time. The same report says the first threatening email, received Oct. 21, demanded about 8 billion yen.
Recommended actions: GMO asked customers with unrecognized trades to tell their exchange or broker that the trades came from unauthorized third-party access and to ask about canceling them and getting a refund. It also said it will never ask for passwords or PIN codes during the compensation process, apart from a view-only trading password (GMO Internet).
Official source: GMO Internet notice (Report 4) ↗GMO Internet notice (Report 7) ↗
FBI public service announcement: critical PHP core vulnerabilities (PHP2Shell)
Issued by: FBI (NSA's own PHP2Shell advisory is listed above)
The FBI said the two PHP flaws “could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” and that security updates “should be applied immediately.” The FBI said the announcement follows its initial social media posting on October 21.
Recommended actions: Update affected PHP installations using the guidance on php.net, take systems offline if they cannot be updated right away, monitor web servers for PHP processes that launch command shells or download files, and report signs of compromise to a local FBI field office or IC3 (FBI).
Official source: FBI PSA on IC3 ↗
Managing AI token consumption for operational resilience
Issued by: CISA, Canadian Centre for Cyber Security and partners (NSA not named on CISA's page)
CISA said unmanaged use of paid AI services can lead to rising costs, reduced service availability, token exhaustion, and “denial-of-tokens or denial-of-wallet attacks.” Canada's Cyber Centre said threat actors carry out these attacks by deliberately generating excessive AI usage to exhaust token allocations or drive up costs.
Recommended actions: Rank AI uses by importance, set usage alerts, monitor unusual spikes in token use as a possible sign of data theft, use more than one AI provider and plan for AI outages (Canadian Cyber Centre, CISA).
Official source: CISA announcement ↗Canadian Cyber Centre guidance ↗
Key practices for incident readiness in super intelligence training and evaluation
Issued by: NIST, NSA Super Intelligence Security Center, CISA
NIST said the voluntary guidance covers incidents in which SI agents “take significant uninstructed actions” that compromise operator controls or human oversight. It sets out ten practices across preparation, detection, response, recovery and reporting.
Recommended actions: Developers of frontier AI systems should build incident plans for training and evaluation using the ten practices (NIST).
Official source: NIST announcement ↗
CNSA 2.0 and Quantum Computing FAQ (October 2026 update)
Issued by: NSA
NSA's advisory library lists an October 2026 update to its Commercial National Security Algorithm Suite 2.0 and quantum computing FAQ, its guidance for moving national security systems to quantum-resistant cryptography.
Recommended actions: Owners and vendors of national security systems should review the updated FAQ and plan their CNSA 2.0 transition (NSA library listing).
Official source: NSA advisory library ↗
Chinese government-linked actors combine automated and hands-on hacking tools (AA26-281A)
Issued by: NSA, FBI, CISA and international partners
NSA said Integrity Technology Group, “a China-based company with links to the Chinese government,” has enabled actors to exploit networks in government, manufacturing, healthcare and IT. NSA said some of the actors use methods consistent with groups known as Flax Typhoon, Ethereal Panda and Red Juliett.
Recommended actions: Disable unused services and ports, sanitize web input, require multifactor authentication and patch promptly (joint advisory).
Official source: NSA press release ↗CISA advisory ↗
China-based AI companies conducting industrial-scale distillation campaigns
Issued by: NSA, FBI, CISA
NSA said China-based AI companies are carrying out “aggressive, industrial-scale distillation activities” to extract the capabilities of U.S. frontier AI models. The agency said the advances could strengthen China's “military and cyberattack capabilities.”
Recommended actions: AI providers, cloud platforms and API aggregators should detect abnormal model use and share threat data with each other (NSA).
Official source: NSA press release ↗
China-linked hacking group QTFY targets military and critical infrastructure
Issued by: NSA, FBI, Cyber National Mission Force
NSA said QTFY has built a scanning platform called QScan, an obfuscation network called QTRouter and botnets of hijacked Internet of Things devices. NSA said it has targeted the Defense Industrial Base, telecommunications, local government and higher education.
Recommended actions: Apply the latest updates, audit internet-facing apps, isolate critical systems from edge devices and hunt for the published indicators (NSA).
Official source: NSA press release ↗
Defending against an active threat to Siemens S7 series PLCs
Issued by: NSA and co-sealing agencies
NSA said actors are scouting U.S.-based Siemens programmable logic controllers “using artificial intelligence-generated exploitation scripts disguised as legitimate monitoring tools.” It named energy, water, chemical, manufacturing and food sectors among the targets.
Recommended actions: Patch, keep PLCs off the internet, use strong access controls and monitor industrial networks (NSA).
Official source: NSA press release ↗
Russian state-supported phishing campaign against Zimbra users
Issued by: NSA, FBI, CISA and allied agencies
NSA said the Russian state-supported group LAUNDRY BEAR has used a “view-based exploit” (CVE-2025-66376) that triggers when a user opens a malicious email in vulnerable Zimbra webmail. NSA said it tries to steal the email directory and the last 90 days of messages.
Recommended actions: Patch Zimbra Collaboration Suite and check for the published indicators (NSA).
Official source: NSA press release ↗
Iranian-affiliated actors exploit PLCs across U.S. critical infrastructure (AA26-097A, updated)
Issued by: FBI, CISA, NSA, EPA, DOE, CNMF, Treasury
The advisory says Iranian-affiliated activity disrupted PLCs in several U.S. sectors, “resulting in operational disruption and financial loss.” The July 22 update added Schneider Electric and Siemens devices to the Rockwell Automation targets first reported on April 7.
Recommended actions: Remove PLCs from direct internet exposure, check logs on ports 44818, 2222, 102 and 502, and put Rockwell controllers' mode switch in run (joint advisory).
Official source: CISA advisory ↗
Russian GRU exploiting vulnerable routers to steal sensitive information
Issued by: FBI (NSA co-sealed)
NSA said GRU unit 85th GTsSS, also known as APT28 and Fancy Bear, hijacked home and small-office routers, including TP-Link devices through CVE-2023-50224. The FBI said the actors changed DNS settings to steal passwords, tokens and emails.
Recommended actions: Change default passwords, turn off remote management from the internet, update firmware, replace end-of-support routers and heed browser certificate warnings (NSA).
Official source: NSA press release ↗FBI IC3 announcement ↗
Telework and mobile security guidance (location data sheet updated April 2026)
Issued by: NSA
NSA's telework and mobile page collects its guides for individuals, including Mobile Device Best Practices and a Limiting Location Data Exposure sheet updated in April 2026.
Recommended actions: Individuals should follow NSA's mobile, home network and social media guides (NSA).
Official source: NSA telework and mobile guidance ↗
Securing space: cybersecurity for low Earth orbit satellite communications
Issued by: NSA with Australia's ACSC and partners
NSA said satellite links “are susceptible to jamming, spoofing, and interception” and that the attack surface grows as constellations expand.
Recommended actions: Users should use frequency hopping, redundant paths and anti-jam antennas, monitor ground stations and secure user devices (NSA).
Official source: NSA press release ↗
AI and machine learning supply chain risks and mitigations
Issued by: Partner agencies, co-sealed by NSA
The guidance says each part of the AI supply chain, from training data and models to hardware and outside services, “may contain vulnerabilities and risks” that attackers could exploit.
Recommended actions: Organizations buying or building AI should check vendors and components against the guidance's risks (NCSC-NZ publication page).
Official source: NSA advisory library ↗New Zealand NCSC publication ↗
Countering Chinese state-sponsored actors feeding a global espionage system (Salt Typhoon)
Issued by: NSA, CISA, FBI and 20 allied agencies
NSA said Chinese state-sponsored actors targeted telecommunications, government, transportation, lodging and military networks worldwide, in activity that “partially overlaps” with industry reporting on Salt Typhoon.
Recommended actions: Telecom and infrastructure defenders should hunt for the published indicators and understand the actors' access before visible eviction steps (NSA).
Official source: NSA press release ↗
North Korea cyber group conducts global espionage campaign (Andariel)
Issued by: FBI, NSA, CISA, CNMF, DC3, South Korea, UK
The advisory says North Korea's RGB 3rd Bureau targets defense, aerospace, nuclear and engineering groups and funds its spying with ransomware attacks on U.S. healthcare entities.
Recommended actions: Patch quickly, protect web servers from web shells, monitor endpoints and strengthen remote-access authentication (joint advisory).
Official source: CISA advisory AA24-207A ↗
Priority labels (Urgent, Active threat, Guidance) are Peter’s World’s own reading-order labels, not agency ratings.
What organizations and individuals should do
- Patch first: NSA and CISA both urge prompt patching, starting with internet-facing systems; for PHP, CISA names versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Turn on multifactor authentication for email, remote access and admin accounts, as several joint advisories above recommend.
- Keep offline backups and test them, since CISA says SafePay actors delete backups before encrypting.
- Keep industrial controllers and routers off the open internet and change default passwords.
- Individuals: update phones and home routers, replace end-of-support devices and use NSA’s telework and mobile guides.
- Report incidents to the FBI’s IC3 or CISA, as the GRU router announcement advises.
Frequently asked questions
What is an NSA cybersecurity advisory?
NSA publishes cybersecurity advisories (CSAs), information sheets (CSIs) and technical reports in its online library. Many are joint products with CISA, the FBI and allied agencies.
Did NSA warn about PHP2Shell?
Yes. On Oct. 21, 2026, NSA issued “NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities,” and CISA issued its own alert the same day.
Did NSA issue the SafePay ransomware advisory?
No. CISA's Oct. 21, 2026 release lists CISA, the FBI, the U.S. Secret Service and international partners as authors; NSA is not named.
Has NSA said anything about the ConnectWise hack?
We found no NSA, CISA or FBI advisory on it as of Oct. 22, 2026. Microsoft attributed the compromise to Storm-0940, which it called a China-state aligned actor.
How often is this page updated?
We check NSA's advisory library and press releases and CISA's advisory list and add new entries with links to the official pages.
Related on Peter’s World
- PHP2Shell: the Oct. 21 cyber emergency
- The War Room: daily war and security reports
- Intelligence agencies explained
- Information War news hub
- DeepSeek ban: what the DHS order tells agencies to do
- All trackers
Additional sources
- NSA advisory library entries also list Gunra ransomware (Aug. 10, 2026), router hygiene against Russian state-sponsored targeting (July 13, 2026) and 2026 minimum elements for a software bill of materials (July 29, 2026): NSA Cybersecurity Advisories & Guidance.
- U.S. Justice Department, court-authorized disruption of the GRU DNS hijacking network (April 7, 2026).
- CISA, release on the Integrity Tech advisory (Oct. 8, 2026).
- CISA, release on the Iran PLC advisory update (July 22, 2026).
Method: entries come from official NSA, CISA, FBI and NIST pages we opened; non-government sources are used only where no agency had issued a warning and are labeled. This page is not an official NSA product.
